Executive brief
strongSwan is an open-source VPN and IPsec suite widely used for secure network communications. A flaw in how identity data is parsed and cloned in the EAP authentication module can cause a double-free memory error, potentially leading to a remote denial of service or code execution if an attacker can influence EAP identity parsing.
Technical details
The vulnerability is a double-free defect in libstrongswan's identity cloning logic. When EAP-Identity data is parsed and results in an empty but non-NULL encoded value, the cloning mechanism fails to properly duplicate the identity object. This causes the same memory location to be freed twice when duplicate identities are destroyed, leading to heap corruption. The flaw affects all strongSwan versions 4.3.3 through 6.0.6. An attacker can trigger the vulnerability during EAP authentication negotiation by supplying specially crafted identity payloads. Patch available in strongSwan 6.0.7 and later.
Affected products
- strongSwan strongSwan 4.3.3 through 6.0.6
Timeline
- 2026-08-22: disclosed
- 2026-06-08: patched: Fixed in strongSwan 6.0.7